Add OCI signing as part of existing publish pipeline

[SgtCoDFish]

The aim is for this to replace the need for hack/push_and_sign_chart.sh and to make charts.jetstack.io downstream of the OCI registry.

⚠️ This is COMPLETELY UNTESTED and mostly AI generated and so probably can't be merged in its current state. But it's a start!

[cert-manager-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign thatsmrtalbot for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[Copilot]

Pull request overview

This PR extends the existing release publish pipeline to publish Helm charts to an OCI registry and sign/verify those OCI artifacts (intended to replace hack/push_and_sign_chart.sh and make charts.jetstack.io downstream of the OCI registry).

Changes:

• Add cosign helpers for signing/verifying with explicit option flags.
• Add Helm OCI helpers (helm push, crane copy) and a new gcb publish action (helmchartoci) to push/sign/verify charts (including non-v tag copy).
• Update the Cloud Build publish job to install/use cosign v3, crane, and helm; plumb a new substitution/flag for the OCI registry target.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
pkg/sign/cosign/cosign.go	Adds optioned cosign sign/verify wrappers used by OCI chart signing.
pkg/release/helm/oci.go	Introduces helper wrappers for helm push to OCI and crane copy tag operations.
gcb/publish/cloudbuild.yaml	Installs cosign v3, crane, and helm; passes new OCI-related args/substitution into cmrel gcb publish.
cmd/cmrel/cmd/publish.go	Adds CLI flag + build substitution for the published Helm chart OCI registry.
cmd/cmrel/cmd/gcb_publish.go	Adds new publish action helmchartoci implementing push/sign/verify logic; adds helm/crane paths + OCI registry options.
cmd/cmrel/cmd/const.go	Adds a default OCI registry constant for Helm chart publishing.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 13 out of 13 changed files in this pull request and generated 4 comments.

Comments suppressed due to low confidence (1)

cmd/cmrel/cmd/gcb_publish.go:734

• gcbPublishOptions now has an injectable Runner intended to control external command execution, but image signing in signOCIImages still calls cosign.Sign, which shells out via shell.Command and ignores o.Runner. That means tests can’t fully fake cosign invocations and production can’t consistently centralize runner behavior. Consider plumbing o.Runner through image signing as well (either by adding a runner-aware helper in pkg/sign/cosign that preserves existing flags/defaults, or by switching to SignWithOptions with explicitly chosen options).

func signOCIImages(ctx context.Context, o *gcbPublishOptions, allContentToSign []string) error {
	if o.SkipSigning {
		log.Println("Skipping signing container images / manifest lists as skip-signing is set")
		return nil
	}